Indexing

Once you have initialized Logger, it starts scanning events automatically and indexing them.

Logger’s storage technology enables automatic indexing of events in these ways:

Full-text indexing: Each event is tokenized and indexed. See Full-Text Indexing (Keyword Indexing).
Field-based indexing: Event fields are indexed based on a predetermined schema. See Field-Based Indexing.
Superindexing: Certain event fields are super-indexed so that you can find rare field values quickly. See Superindexing.

All events received after initialization are indexed for full-text search, a default set of fields is indexed for field-based search, and a default set of fields is superindexed for fast needle-in-a-haystack searches.

All events are timestamped with the receipt time when received on the Logger. The default fields are automatically indexed. For the remaining fields, Logger uses the receipt time of an event and the time when a field was added to the index to determine whether that event will be indexed. If the receipt time of the event is equal to or later than the time when the field was added to the index, the event is indexed; otherwise, it is not.